File-based detection does not work

[marrak]

What happened:
grant does not return any result for LICENSE file in directory

What you expected to happen:
grant should find license in LICENSE file and list data

Steps to reproduce the issue:

1. Clone grant github repository
2. Run: grant list dir:<repo dir>
3. Copy LICENSE to another empty directory
4. Run: grant list dir:<dir>

Anything else we need to know?:

(2) For v0.1.1 grant returns:

* src/
  * Apache License 2.0
  * Apache-2.0
  * BSD 2-Clause "Simplified" License
  * BSD 3-Clause "New" or "Revised" License
  * BSD-2-Clause
  * BSD-3-Clause
  * GNU General Public License v2.0 only
  * GNU General Public License v2.0 or later
  * GPL-2.0-only
  * GPL-2.0-or-later
  * GPL-3.0
  * MIT
  * MIT License
  * MPL-2.0
  * Mozilla Public License 2.0
  * Zlib
  * zlib License

(4) For v0.1.1 grant returns:

* repo/
  * Apache-2.0

---

grant v0.6.2 returns:

(2)

grant list dir:src/grant/
 ✔ Loaded dir:src/grant/                              image
 ✔ License listing
 ✔ Cataloged contents
   ├── ✔ Packages                       [319 packages]
   ├── ✔ Licenses                       [0 unique]
   └── ✔ File metadata                  [319 locations]
 ✔ Aggregated licenses                [grouped by license, desc by count]

 LICENSE              PACKAGES  RISK
 (no licenses found)       309  Unknown

(4)

grant list dir:repo/
 ✔ Loaded dir:repo/                              image
 ✔ License listing
 ✔ Cataloged contents
   ├── ✔ Packages                       [0 packages]
   ├── ✔ Licenses                       [0 unique]
   └── ✔ File metadata                  [0 locations]
 ✔ Aggregated licenses                [grouped by license, desc by count]

 LICENSE  PACKAGES  RISK

Environment:

• Output of grant version:
• OS (e.g: cat /etc/os-release or similar): RHEL9

[wagoodman]

Can you let us know what you ran grant against to reproduce this? I was not able to see a difference between v0.1.1 and v0.6.2 for the src/grant dir within the grant repo. When I scanned the root of the repo, I see a difference, however, v0.6.2 appears to be more accurate (and more licenses found) than with v0.1.1 (which is expected).

[marrak]

@wagoodman I'm cloning github master grant repository, nothing more.
git clone https://github.com/anchore/grant.git
Downloading grant
curl -sSfL https://get.anchore.io/grant | sh -s -- -b /home/buildslave/grant/
And run grant
./grant -v list /home/buildslave/grant/repo/
There is no grant config at all.
I'm running it on RHEL 9.1. I don't know what more could I explain?

[willmurphyscode]

Hi @marrak I've being trying to repro this via docker in case there's something platform specific.

$ git clone git@github.com:anchore/grant
$ cd grant
$ docker run --rm -v $PWD:/grantsource anchore/grant list -v dir:/grantsource
[0000] DEBUG No configuration file found, using defaults
 LICENSE              PACKAGES  RISK
 (no licenses found)       356  Unknown
 Apache 2.0                  1  Unknown

I think this is expected. The 356 packages are transitive dependencies of grant, and are unknown. The Apache 2.0 license is the one we put there in the source code for grant.

If I run directly on the host (darwin/arm64):

$ grant list -v dir:grant
 ⠋ Loading dir:grant
 ✔ Loaded dir:grant                              image
 ✔ License listing
 ✔ Cataloged contents
   ├── ✔ Packages                       [1061 packages]
   ├── ✔ Licenses                       [76 unique]
   └── ✔ File metadata                  [1061 locations]
 ✔ Aggregated licenses                [grouped by license, desc by count]

 LICENSE              PACKAGES  RISK
 (no licenses found)       310  Unknown
 [Apache-2.0](https://spdx.org/licenses/Apache-2.0.html)                 44  Low
 [BSD-3-Clause](https://spdx.org/licenses/BSD-3-Clause.html)               40  Low
 [MIT](https://spdx.org/licenses/MIT.html)                        37  Low
 [BSD-2-Clause](https://spdx.org/licenses/BSD-2-Clause.html)                2  Low
 [GPL-2.0-only](https://spdx.org/licenses/GPL-2.0-only.html)                2  High
 [GPL-3.0-only](https://spdx.org/licenses/GPL-3.0-only.html)                2  High
 [MPL-2.0](https://spdx.org/licenses/MPL-2.0.html)                     2  Medium
 [AGPL-3.0-only](https://spdx.org/licenses/AGPL-3.0-only.html)               1  High
 Apache 2.0                  1  Unknown
 [Apache-1.1](https://spdx.org/licenses/Apache-1.1.html)                  1  Low
 [Artistic-1.0](https://spdx.org/licenses/Artistic-1.0.html)                1  Unknown
 [BSD-2-Clause-Patent](https://spdx.org/licenses/BSD-2-Clause-Patent.html)         1  Low
 [CATOSL-1.1](https://spdx.org/licenses/CATOSL-1.1.html)                  1  Unknown
... snip ...

I think the reason these two are different is that grant on the host has access to my host's Go proxy cache, and so can ask the Go proxy cache about the licenses for those. In the container it can't.

But what I don't understand is why you find no licenses at all.

(It's worth noting that in the grant root, there's a .grant.yaml, which grant will pick up. But I still find packages either way).

No matter how I invoke grant on its own source code, I see at least the Apache-2.0 license for grant itself.

You mentioned that you're copying just the license into its own directory in the original post, but then not in your last comment. Do you think you could give us a full list of shell commands and their outputs? I haven't been able to repro what you're seeing.

[kzantow]

I'm seeing similar behavior following the steps above, both when running locally and when run through docker:
I cloned the grant repo iself to $(pwd)/grant-repo.

% docker run --rm -it -v $(pwd)/grant-repo:/src anchore/grant:latest version         
Application:    grant
Version:        0.6.3

...

% docker run --rm -it -v $(pwd)/grant-repo:/src anchore/grant:latest -v list dir:/src
 ⠋ Loading dir:/src
 ✔ Loaded dir:/src                              image
 ✔ License listing
 ✔ Cataloged contents
   ├── ✔ Packages                       [320 packages]
   ├── ✔ Licenses                       [0 unique]
   └── ✔ File metadata                  [320 locations]
 ✔ Aggregated licenses                [grouped by license, desc by count]

 LICENSE              PACKAGES  RISK    
 (no licenses found)       310  Unknown 

 % ./grant -v list dir:$(pwd)/grant-repo
 ⠋ Loading dir:/Users/kzantow/Downloads/grant-thing/grant-repo
 ✔ Loaded dir:/Users/kzantow/Downloads/grant-thing/grant-repo                              image
 ✔ License listing
 ✔ Cataloged contents
   ├── ✔ Packages                       [320 packages]
   ├── ✔ Licenses                       [0 unique]
   └── ✔ File metadata                  [320 locations]
 ✔ Aggregated licenses                [grouped by license, desc by count]

 LICENSE              PACKAGES  RISK    
 (no licenses found)       310  Unknown